gpio: virtuser: fix potential out-of-bound write

[ Upstream commit 7118be7c6072f40391923543fdd1563b8d56377c ]

If the caller wrote more characters, count is truncated to the max
available space in "simple_write_to_buffer". Check that the input
size does not exceed the buffer size. Write a zero termination
afterwards.

Reported-by: kernel test robot <lkp@intel.com>
Closes: https://lore.kernel.org/oe-kbuild-all/202505091754.285hHbr2-lkp@intel.com/
Signed-off-by: Markus Burri <markus.burri@mt.com>
Link: https://lore.kernel.org/r/20250509150459.115489-1-markus.burri@mt.com
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>

diff --git a/drivers/gpio/gpio-virtuser.c b/drivers/gpio/gpio-virtuser.c
index e89f299f214009484d6389e3e41a9fcc5a0ca3c4..dcecb7a25911761f55e549c6e4d2117c6b90a422 100644 (file)
--- a/drivers/gpio/gpio-virtuser.c
+++ b/drivers/gpio/gpio-virtuser.c
@@ -400,10 +400,15 @@ static ssize_t gpio_virtuser_direction_do_write(struct file *file,
        char buf[32], *trimmed;
        int ret, dir, val = 0;
 
-       ret = simple_write_to_buffer(buf, sizeof(buf), ppos, user_buf, count);
+       if (count >= sizeof(buf))
+               return -EINVAL;
+
+       ret = simple_write_to_buffer(buf, sizeof(buf) - 1, ppos, user_buf, count);
        if (ret < 0)
                return ret;
 
+       buf[ret] = '\0';
+
        trimmed = strim(buf);
 
        if (strcmp(trimmed, "input") == 0) {
@@ -622,12 +627,15 @@ static ssize_t gpio_virtuser_consumer_write(struct file *file,
        char buf[GPIO_VIRTUSER_NAME_BUF_LEN + 2];
        int ret;
 
+       if (count >= sizeof(buf))
+               return -EINVAL;
+
        ret = simple_write_to_buffer(buf, GPIO_VIRTUSER_NAME_BUF_LEN, ppos,
                                     user_buf, count);
        if (ret < 0)
                return ret;
 
-       buf[strlen(buf) - 1] = '\0';
+       buf[ret] = '\0';
 
        ret = gpiod_set_consumer_name(data->ad.desc, buf);
        if (ret)